A network that doesn’t need a senior engineer to debug.

The diagram took a week to produce because the senior engineer was the only one with the full picture. Every new region had been added by extending the mesh; nobody had paused to redesign. Some peerings were transitive-via-firewall, some weren’t. Some routes were static, some weren’t.

We migrated VPC by VPC to Transit Gateway with three route tables — production, non-production, shared services — and a clean inter-region peering topology. Network Firewall handled north-south inspection; flow logs landed in a central account for the platform team.

After cutover, four engineers ran a tabletop debugging exercise on a synthetic incident. All four found the root cause inside fifteen minutes. The original engineer took the next two weeks off. Nothing broke.